Owasp Zap Testing rest api

Question

Is that possible to testing rest-api via OWASP ZAP ? Url to attack worked just for GET requests.

For example, my api controllers work with only token. I have TokenController and this controller require POST data via JSON data include password and login. Can I someway testing this controller via OWASP ?

Solution

The short answer is yes. The long answer - it's complicated :)

Testing REST API is a bit harder than testing web API - you'll have to give Zap information about your API - which endpoints it has, parameters, etc. Can you share more about you're API? Does it have OpenAPI/Swagger document? Do you have existing tests? You can use either one of those for this task.

I gave a talk about how this can be achieved - you can find the recording here.